soft3/deploy/chain/soft3-chain@.service

ฯ€ 0.0% 199 words ยท 1 min 
# soft3 phase-1 root chain โ€” one instance per chain: soft3-chain@pussy, soft3-chain@bostrom.
# Parameters come from /etc/soft3/<chain>.env (template: chain.env.example).
# Install: sudo cp soft3-chain@.service /etc/systemd/system/ && sudo systemctl daemon-reload
# Start:   sudo systemctl enable --now soft3-chain@pussy   (genesis day only โ€” see README.md)
[Unit]
Description=soft3 root chain node (%i) โ€” cybergraph + bbg + radio
Documentation=https://github.com/cyberia-to/soft3/tree/main/deploy/chain
After=network-online.target time-sync.target
Wants=network-online.target time-sync.target
# PoW timestamp rules assume a sane clock: refuse to start when the clock is not NTP-synchronized.
ConditionPathExists=/etc/soft3/%i.env
StartLimitIntervalSec=300
StartLimitBurst=5

[Service]
Type=simple
User=cyber
Group=cyber
EnvironmentFile=/etc/soft3/%i.env
Environment=HOME=/home/cyber
Environment=PATH=/home/cyber/.cargo/bin:/usr/local/bin:/usr/bin:/bin
Environment=RUST_LOG=info
# State lives in /var/lib/soft3/<chain>; on deimos symlink /var/lib/soft3 to the raid before the first start.
StateDirectory=soft3/%i
StateDirectoryMode=0750
WorkingDirectory=/var/lib/soft3/%i
ExecStartPre=/usr/local/bin/soft3-chain-check --pre %i
# The executable path is fixed (systemd does not expand variables in the first token).
ExecStart=/home/cyber/.cargo/bin/soft3 node \
    --chain ${SOFT3_CHAIN} \
    --home /var/lib/soft3/%i \
    --bind ${SOFT3_BIND} \
    --radio ${SOFT3_RADIO} \
    --peers /etc/soft3/%i.peers.toml \
    --moniker ${SOFT3_MONIKER}
Restart=always
RestartSec=5
TimeoutStopSec=60
KillSignal=SIGTERM

# resource guards โ€” the 0.10.0 chaosnet node reached 1,800 threads under a request convoy (2026-10-15)
# MemoryMax is per machine: drop-in /etc/systemd/system/soft3-chain@<chain>.service.d/limits.conf
# (template: limits.conf.example) โ€” systemd does not expand variables in MemoryMax.
LimitNOFILE=65536
TasksMax=2048
LogRateLimitIntervalSec=30
LogRateLimitBurst=2000

# hardening
NoNewPrivileges=true
ProtectSystem=full
ProtectHome=read-only
PrivateTmp=true
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictSUIDSGID=true

[Install]
WantedBy=multi-user.target

Graph